Hubbry Logo
Kaspersky LabKaspersky LabMain
Open search
Kaspersky Lab
Community hub
Kaspersky Lab
logo
8 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Kaspersky Lab
Kaspersky Lab
from Wikipedia

Kaspersky Lab (/kæˈspɜːrski/; Russian: Лаборатория Касперского, romanizedLaboratoriya Kasperskogo) is a Russian multinational cybersecurity and anti-virus provider company, which is headquartered in Moscow, Russia,[1] and operated by a holding company in the United Kingdom until it closed in 2024.[4] It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, endpoint security, SIEM, XDR, and other cybersecurity products and services.[5][6] The Kaspersky Global Research and Analysis Team (GReAT) has led the discovery of sophisticated espionage platforms conducted by nations, such as Equation Group and the Stuxnet worm.[7] Their research has uncovered large-scale and highly technical cyber espionage attempts. Kaspersky also publishes the annual Global IT Security Risks Survey.[8]

Key Information

Kaspersky expanded abroad from 2005 to 2010 and grew to $822 million in annual revenues by 2024.[9][2] In 2010, Kaspersky Lab ranked fourth in the global ranking of antivirus vendors by revenue.[10] It was the first Russian company to be included into the rating of the world's leading software companies, called the Software Top 100 (79th on the list, as of June 29, 2012).[11] In 2016, Kaspersky's research hubs analyzed more than 350,000 malware samples per day.[12] In 2016, the software had about 400 million users and was one the largest market-share of cybersecurity software vendors in Europe.

The US government has alleged that Kaspersky has engaged with the Russian Federal Security Service (FSB)—ties which the company has actively denied.[13][14][15] In 2017, the Trump administration issued a ban of Kaspersky software on federal civilian and military computers. In response to these and other allegations, Kaspersky began to solicit independent reviews and verification of its source code, and relocated core infrastructure and customer data from Russia to Switzerland. Multiple countries have banned or restricted their government agencies from using Kaspersky products, including Lithuania,[16] the Netherlands,[17] and the United States.[18]

As of 2025, Kaspersky has over 30 offices in Europe, Middle East, Africa, Asia, and Latin America, and customers in over 200 countries.[19][20]

History

[edit]

The first version of Kaspersky Lab's antivirus software was developed by Eugene Kaspersky in 1989 in response to the Cascade Virus.[21][22] Early versions had just 40 virus definitions and were mostly distributed to friends and family members.[23] Kaspersky continued developing the software at KAMI,[23][24] resulting in the AntiViral Toolkit Pro (AVP) product released in 1992.[24][25][26] It was popularized in 1994 after a competitive analysis by Hamburg University gave his software first place.[24][25][26][27]

In 1997, Eugene Kaspersky, his wife Natalya Kaspersky, and Alexey De-Monderik left KAMI to form Kaspersky Lab,[28][a] and to continue developing the antivirus product, then called AVP.[31][32] The product was renamed Kaspersky Anti-Virus after an American company registered the AVP trademark in the US.[31]

In 1998, a Taiwanese student released a virus called CIH. During the first three weeks of the outbreak, Kaspersky Lab's AVP was the only software at the time able to remove it. This increased demand and led to deals with antivirus companies in Japan, Finland and Germany to integrate AVP into their software.[23][31][33]

According to WIRED, Kaspersky's software was "advanced for the time". For example, it was the first software to monitor viruses in an isolated quarantine.[34] The company's revenue grew 280 percent from 1998 to 2000, with about 60 percent of its revenue coming from foreign sales.[31] Natalya worked to broker deals abroad and localize the software. It opened offices in the UK, Poland, Holland and China. It later expanded to Germany, France, the US and Japan.[33] By 2000, the company had 65 employees and sales in more than 40 countries.[31] Kaspersky opened new offices in South East Asia and the Middle East in 2008[24] and in South Africa in 2009.[35] It also expanded in India, the Middle East and Africa in 2010.[24][36] In 2009, retail sales of Kaspersky Lab's antivirus products reached almost 4.5 million copies per year.[28]

In 2011, General Atlantic bought a 20 percent share of Kaspersky Lab for $200 million, with the expectation of helping the company go public. A few months later, the decision was made to keep the firm private and Kaspersky re-purchased the shares from General Atlantic.[37][38][39] This was followed by numerous executive departures in 2011 and 2014 regarding disputes over going public and over Eugene Kaspersky's management style.[40]

On January 1, 2012, Kaspersky Lab officially left the Business Software Alliance (BSA) over SOPA. The BSA had supported the controversial anti-piracy bill, but Kaspersky Lab did not support it stating, "we believe that such measures will be used contrary to the modern advances in technology and the needs of consumers," and to show their disapproval, announced their intent to leave on December 5, 2011.[41][42]

By 2013, the company had an unaudited $667 million in annual revenues.[40] In 2014, Kaspersky Lab signed a distribution deal with Ingram Micro, which significantly expanded its reseller program.[43]

In August 2015, two former Kaspersky employees alleged that the company introduced modified files into the VirusTotal antivirus database to trick software from Kaspersky competitors into triggering false positives in virus and malware scans. A possible motive is that Eugene Kaspersky allegedly was furious at competitors perceived to be "unfairly" free-riding on Kaspersky's malware discoveries via the open-source VirusTotal database. The company denied the allegations.[44][45][46] On his personal blog, Eugene Kaspersky compared the accusations to unsubstantiated conspiracy theories.[47] Reuters followed up by publishing leaked emails allegedly from Kaspersky alluding to "falsies" and "rubbing out" foreign competitors; Kaspersky Lab stated the emails "may not be legitimate and were obtained from anonymous sources that have a hidden agenda".[48]

In 2016, Kaspersky executive Ruslan Stoyanov was arrested by Russian authorities on charges predating his work at Kaspersky.[49] In 2019, he was convicted of treason.[50][51]

In June 2023, Kaspersky Lab said many of its senior staff and managers were hit by an ongoing attack that it first suspected in early 2023 and has compromised thousands of iPhones. The oldest traces of infection date back to 2019.[52] The Russian Federal Security Service (FSB) separately accused the US National Security Agency and company Apple of being behind the attack and infiltrating the phones of diplomats from China, Israel, NATO members, and Syria. Kaspersky Lab said it does not believe itself to be the main target and that it had not shared its own findings about the attack with Russian authorities until the FSB announcement.[53]

On 20 June 2024, after the US announced that it would prohibit Kaspersky from selling or distributing updates to its software to US customers and sanctioned 12 of its senior leaders, the company announced it would leave the US market.[19][54][55] On September 25, the company abruptly replaced its software on US users' computers with UltraAV software developed by US cybersecurity firm Pango, angering some users.[56][57]

Products and services

[edit]
Home screen of Kaspersky Internet Security

Kaspersky Lab develops and markets antivirus, internet security, password management, endpoint security, and other cybersecurity products and services.[5] It is the fourth or fifth largest endpoint security vendor[24][58] and the third largest consumer IT security software company.[24] It is the sixth largest overall IT security company.[59] Its revenues are about 15 percent from Russian companies domestically, one-third from European organizations and one-fourth from US organizations.[60] The software has about 400 million users in all.[61]

Kaspersky's consumer software include the Antivirus, Internet Security and Total Security products.[62] The Antivirus software includes malware protection, monitors the PC for suspicious program behavior, and warns users about potentially dangerous websites. The Internet Security software adds privacy features, parental controls, anti-phishing tools.[63][64] Total Security adds parental controls, adult website filters, diagnostic tools, a Password Manager application, and other features.[62][65] Since 2023, the new lineup was introduced, with Kaspersky Basic, Plus and Premium replacing Antivirus, Internet Security and Total Security.[66] Kaspersky's software is available for Macs, PCs, Android, iOS, Windows Mobile, BlackBerry and Symbian.[67][68]

For businesses, the company has developed Kaspersky Industrial CyberSecurity for OT environments, and Kaspersky Hybrid Cloud Security for container infrastructures. Detection and response solutions include Kaspersky Next XDR Expert, Kaspersky Next EDR Optimum, and Kaspersky SIEM for centralized security monitoring. The company markets the Kaspersky Endpoint Security for Business suite. It includes a centralized user interface and management application called the Kaspersky Security Center. The cybersecurity software itself is called the Kaspersky Security Network. The Kaspersky Administration KitSecurity Center manages configuration, installation and remote use. The business suite also has quarantine, reporting, and other features.[69] Its software product for businesses with 25 staff or less is called Kaspersky Small Office Security (KSOS).[70] Within the suite are products specifically for virtualization security,[71] mobile security,[72] and fraud protection[73] among others. Kaspersky also develops a free tool that helps businesses gain access to Windows devices that are infected by ransomware.[74] In 2017, KasperskyOS, a secure operating system, was released,[75] and in 2021, Kaspersky IoT Secure Gateway 100 for IoT was introduced based on it.[76] Among cloud solutions, Kaspersky Hybrid Cloud Security protects cloud infrastructures, and Kaspersky SD-WAN ensures secure corporate networks.

KasperskyOS

[edit]

KasperskyOS is a proprietary microkernel operating system built from scratch using secure-by-design principles. It's developed by Kaspersky for embedded and industrial devices with heightened cybersecurity demands. It features minimal trusted kernel, strict isolation of components in user space, default-deny policy enforcement and formal, policy-based control via the Kaspersky Security System. The aim is to create “Cyber Immune” systems that keep critical functions operating even if some parts of the system are attacked via unknown vulnerabilities. Key use cases are network equipment, industrial control/IoT gateways, smart cars, smart city and transport infrastructure, and other critical-infrastructure uses.[77]

KasperskyOS is distributed both as a platform and inside finished appliances such as the Kaspersky IoT Secure Gateway (KISG 100/1000), while early deployments also appeared in Kraftway routing/switching gear.

There is a community edition for prototyping and development.[78]

Threatpost

[edit]

Threatpost is a discontinued[79] computer security blog which was funded by Kaspersky Lab. According to Eugene Kaspersky, it was independent of Kaspersky.[80] It was launched in 2009.[81][82] After August 2022, no new articles have been published on the site.[83]

Partnerships

[edit]

The Kaspersky Anti-Virus engine also powers products or solutions by other security vendors, such as Check Point, Bluecoat, Juniper Networks, Microsoft Forefront,[84] Netintelligence, Clearswift, FrontBridge, Netasq, Wedge Networks, and others. Altogether, more than 120 companies are licensing technology from Kaspersky Lab. Kaspersky Lab also has a number of partnerships with various technology companies.

The International Multilateral Partnership Against Cyber Threats in which Datuk Mohd Noor Amin acts as the chairman, announced the appointment of Harry Cheung – Managing Director of Kaspersky Lab, APAC – as the Goodwill Ambassador for Greater China.[85]

Kaspersky Lab was a long-term partner of Scuderia Ferrari and in December 2021, announced a partnership extension with the Formula One team, and also became the team's esports partner.[86] However, in March 2022 the deal was paused as a joint decision taken by the two companies due to the 2022 Russian invasion of Ukraine.[87]

In 2024, Kaspersky and the African Union's law enforcement agency, AFRIPOL, signed a five-year cooperation agreement to prevent and combat cybercrime.[88]

Interpol

[edit]

INTERPOL and Kaspersky have maintained a long-standing partnership aimed at preventing and combating cybercrime worldwide. In 2013, Kaspersky supported INTERPOL's Global Complex for Innovation in Singapore by providing advanced digital forensics tools and expertise to aid international investigations.[89]

In 2016, the two organizations signed a cyber threat intelligence exchange agreement to enhance real-time data sharing on emerging threats.[90] This cooperation was renewed and expanded in 2019, enabling joint operations targeting major malware campaigns and organized cybercrime groups.[91]

During the 2024 Summer Olympics in Paris, Kaspersky supported INTERPOL in countering cyberattacks aimed at the Games’ infrastructure and participants.[92] In 2025, their joint efforts helped dismantle over 20,000 malicious IP addresses and domains linked to information-stealing malware, as part of a global crackdown involving law enforcement from more than 50 countries.[93]

The partnership focuses on sharing threat intelligence and strengthening global cybersecurity resilience.[94]

Market assessments and reception

[edit]

According to 2016 reviews in PC Magazine, Kaspersky AntiVirus and competitor Bitdefender were both consistently ranked at the top in independent competitive tests.[95][96] PC Magazine's own malware and phishing tests showed similar results. Noted pros — “bonus security tools” and a large number of Kaspersky Total Security features, including password management, encryption and parental control software. Minuses — scanning took longer than expected.[95] The product received high scores in lab tests for antivirus, antiphishing and other features and “average” scores in tests for antivirus and spam filtering.[97]

Kaspersky's 2013 Endpoint Security for Windows product was the top-ranked enterprise antivirus software in a competitive test by Dennis Technology Labs, followed by Symantec Endpoint Protection.[98] AV-Comparatives awarded Kaspersky "Product of the Year" for 2015, based on the number of high scores it received throughout the year on a wide range of tests.[96][99][100][b] PC Magazine praised the software's features, but said it lacked policy management and deployment options.[101] Kaspersky's parental control software has been praised by PC Magazine for its “very affordable parental control and monitoring,” software content filtering, child profiles, social media monitoring and other features. Downsides noted: some features only available for iOS or Android.[97]

The anti-virus software testing group AV-Comparatives gave the Windows XP version of Kaspersky AV an "Advanced+" rating (its highest) in both its February 2008 on-demand detection test (with the fourth highest detection rate among 16 products tested).[102] However, in the Retrospective/Proactive Test May 2008, Kaspersky received the "Standard" rating, detecting 21% of new malware with 1-month old signatures and receiving a substantial amount of false positives.[103]

The firewall included in Kaspersky Internet Security 7.0 got a "Very Good" rating in Matousec's Firewall challenge,[104] with a result of 85%. Kaspersky Anti-Virus 7.0 has achieved a 6.5 result out of 8 in the Anti Malware Labs rootkit detection test.[105] It has also achieved a 31 out of 33 detection of polymorphic viruses[106] and a 97% result in the self-protection test.[107] In 2007, Kaspersky Internet Security 7 received an award from the British magazine PC Pro and also won a place in its "A List".[108]

Kaspersky has passed most of the Virus Bulletin comparative tests since August 2003.[109] In 2005, according to PC World magazine, Kaspersky anti-virus software provided the fastest updates for new virus and security threats in the industry.[110]

In PC World magazine's March 2010 comparison of consumer security suites, Kaspersky Internet Security 2010 scored 4.5/5 stars, and was rated second overall.[111] In the December 2011 version of AV-Comparatives' annual reports, Kaspersky Lab's software achieved the highest overall ranking and has earned the AV Comparatives' "Product of the Year" award.[112]

On February 1, 2012, Kaspersky Internet Security earned "AV-TEST Award for Best Repair 2011" award in the field of home user products from AV-TEST Institute.[113] On January 28, 2013, Kaspersky Endpoint Security earned "AV-TEST Award for Best Protection 2012" and "AV-TEST Award for Best Repair 2012" awards in the field of corporate products from AV-TEST Institute.[114]

Later in 2013, Kaspersky earned the product of the year award from AV-Comparatives and the highest score among Enterprise solutions in a Dennis Technology Labs report.[100][115]

Kaspersky has also received certification of its products through the OESIS OK Certification Program, which verifies that the applications are interoperable with third-party technology solutions like NAC and SSL VPN products from Cisco Systems, Juniper Networks, F5 Networks, and others.[116]

Kaspersky products regularly participate in and achieve high results[117][118] in independent tests by AV-Test,[119] AV-Comparatives,[120] and SE Labs.[121] These organizations are members of the Anti-Malware Testing Standards Organization (AMTSO),[122] which Microsoft has adopted as an “industry standard organization” for independent certification purposes.[123]

Finances

[edit]
Year Revenue in million US$ Growth / Decrease Development rate
2012 628[124] Increase 3%
2013 667[40] Increase 6%
2014 711[125] Increase 6,6 %
2015 619[126] Decrease 13%
2016 644[127] Increase 4%
2017 698[127] Increase 8%
2018 726[128] Increase 4%
2019 685[129] Decrease 6%
2020 703,9[130] Increase 3%
2021 752,3[130] Increase 6,8 %
2022 752,5[130] Increase 0,03 %
2023 721[131] Decrease 4,1 %
2024 822[2] Increase 14%

Malware discovery

[edit]

Kaspersky Lab's Global Research and Analysis Team (GReAT) was established in 2008.[132] It investigates cybersecurity threats and other work by malware operations.[133] IT security companies are often evaluated by their ability to uncover previously unknown viruses and vulnerabilities.[134] Kaspersky's reputation for investigating cyber-security threats has been influential in gaining sales and prestige.[134][135] Beginning around 2010, Kaspersky exposed a series of government-sponsored cyber-espionage and sabotage efforts. These include Stuxnet, Duqu, Flame, Gauss, Regin and the Equation Group.[133][136] According to Wired, "many of them [were] seemingly launched by the US and its UK and Israeli allies. Kaspersky is especially well-known for its work uncovering Stuxnet, Careto,[137] and Flame."[61]

Stuxnet

[edit]

In 2010, Kaspersky Lab worked with Microsoft to counteract the Stuxnet worm, which had infected 14 industrial locations in Iran using four zero-day vulnerabilities in Microsoft Windows.[138] According to IEEE Spectrum, the circumstances "strongly suggest" the worm was developed by the United States and Israel to damage centrifuges in Iran's nuclear-enrichment program. It was the first discovery of a major government-sponsored cyber-attack.[134][139]

Flame

[edit]

In May 2012, Kaspersky Lab identified the malware Flame, which a researcher described as potentially "the most sophisticated cyber weapon yet unleashed".[140] According to the researchers in Kaspersky Lab, the malware had infected an estimated 1,000 to 5,000 machines worldwide[141][142] when asked by the United Nations International Telecommunication Union to investigate reports of a virus affecting Iranian Oil Ministry computers.[143] As Kaspersky Lab investigated, they discovered an MD5 hash and filename that appeared only on customer machines from Middle Eastern nations. After discovering more pieces, researchers dubbed the program "Flame" after the name of one of its modules.[143]

Flame was an earlier variant of Stuxnet. Kaspersky never verified the source of the software, but it is suspected to have been developed by the National Security Agency (NSA) to transmit keystrokes, Skype calls and other data.[144][145][141] Kaspersky created algorithms to find similar malware and found Gauss that July, which collected and transmitted data from devices infected by bluetooth or USB drives.[134][146]

Red October

[edit]

In January 2013, Kaspersky discovered the Red October malware, which had been used for widespread cyber-espionage for five years. It targeted political targets like embassies, nuclear sites, mostly in Europe, Switzerland and North America. The malware was likely written by Russian-speaking hackers and the exploits by Chinese hackers.[147][148] That June, Kaspersky discovered NetTraveler, which it said was obtaining data on emerging technology from government targets and oil companies. Kaspersky did not identify who was behind it, but it was similar to other cyber-espionage coming from Beijing, China.[149][150] Later that same year, Kaspersky discovered a hacker group it called Icefog after investigating a cybersecurity attack on a Japanese television company. Kaspersky said the hacker group, possibly from China, was unique in that they targeted specific files they seemed to know about before planting malware to extract them.[151][152]

Mask

[edit]

In February 2014, Kaspersky identified the malware Mask, which infected 380 organizations in 31 countries. Many organizations that were affected were in Morocco. Some of the files were in Spanish and the group is believed to be a state conducting espionage, but Kaspersky did not speculate on which country may have developed it.[153][154]

Regin

[edit]

In November 2014, Symantec and Kaspersky authored papers that contained the first disclosure of malicious software named Regin.[155] According to Kaspersky, Regin is similar to QWERTY, a malware program discovered the next year.[156] Regin was used to take remote control of a computer and is believed to have originated from the Five Eyes alliance.[157] That same month Kaspersky reported on the Darkhotel attack, which targeted users of wireless networks at hotels in Asia. It asked users to update their software, and then download malware that gave up their passwords.[158][159][160]

Equation Group

[edit]

In 2015, Kaspersky identified a highly sophisticated threat actor that it called "The Equation Group". The group incorporated sophisticated spying software into the firmware of hard drives at banks, government agencies, nuclear researchers and military facilities, in countries that are frequent targets of US intelligence efforts.[161] It is suspected to have been developed by the National Security Agency (NSA) and included many unique technical achievements to better avoid detection.[162] That same day, Kaspersky announced the discovery of a hacker group it called Carbanak, which was targeting banks and moving millions of dollars into fake accounts. Carbanak was discovered when one bank asked Kaspersky to investigate suspicious behavior from its ATMs.[163] A similar malware using some of the same techniques as Carbanak was discovered in 2016 and dubbed Carbanak 2.0.[164]

Duqu

[edit]

In June 2015, Kaspersky reported that its own network had been infiltrated by government-sponsored malware. Evidence suggested the malware was created by the same developers as Duqu and Stuxnet, in order to get intelligence that would help them better avoid detection by Kaspersky in the future. Kaspersky called it Duqu 2.0.[136] The malicious software resided in memory to avoid detection. The hack was believed to have been done by the same group that did Duqu in 2011. It used exploits in Microsoft installer files.[165]

Android cyber-espionage

[edit]

In June 2015, Kaspersky Lab and Citizen Lab both independently discovered software developed by Hacking Team and used by 60 governments around the world to covertly record data from the mobile phones of their citizens. The software gave police enforcement a "menu of features" to access emails, text messages, keystrokes, call history and other data.[166][167][168] Kaspersky also identified 37,000 attacks against banking companies that used modifications of the malware called Asacub and took control of Android devices. Asacub targeted mostly banking customers in the US, Russia and Ukraine using an SMS message that baited users into installing a Trojan.[169]

Silverlight

[edit]

In 2016, Kaspersky discovered a zero day vulnerability in Microsoft Silverlight.[170][171] Kaspersky identified a string of code often used by exploits created by the suspected author. It then used YARA rules on its network of Kaspersky software users to find that string of code and uncover the rest of the exploit. Afterwards, Microsoft issued a "critical" software patch to protect its software from the vulnerability.[170][171]

Poseidon Group

[edit]

In 2016, Kaspersky uncovered the Poseidon Group, which would infiltrate corporations with malware using phishing emails, then get hired by the same company as a security firm to correct the problem. Once hired, Poseidon would install additional malware and backdoors.[172] In June 2016 Kaspersky helped uncover a Russian hacking group, leading to 50 arrests.[61]

Titanium

[edit]

In 2019, Kaspersky uncovered Titanium, a very advanced and insidious backdoor malware APT, developed by PLATINUM, a cybercrime collective. Kaspersky Lab reported the malware on November 8, 2019.[173][174][175][176][177][178]

MATA Toolset Campaign

[edit]

In 2020, Kaspersky published research on the MATA Toolset Campaign, a sophisticated cyber-espionage framework targeting multiple operating systems, including Windows, macOS, and Linux. The malware, attributed to the Lazarus Group, was used for stealing databases, distributing ransomware, and installing backdoors on infected systems. MATA's capabilities allowed attackers to execute a wide range of malicious activities, including exfiltrating sensitive data from corporate networks and compromising financial systems. The campaign highlighted the increasing cross-platform threat posed by state-sponsored actors. In September 2022 and October 2023, new malware samples linked to the MATA cluster were uncovered.[179][180][181]

PyPI Supply Chain Attack

[edit]

In 2024, Kaspersky uncovered a year-long supply chain attack targeting the Python Package Index (PyPI), a popular repository for Python developers. Attackers uploaded malicious packages containing JarkaStealer, a malware designed to exfiltrate sensitive information from infected systems. These packages were disguised as legitimate tools and lured victims through social engineering tactics, including AI (OpenAI's ChatGPT) chatbots offering assistance. The campaign demonstrated the vulnerability of open-source ecosystems and emphasized the importance of scrutinizing dependencies in software development.[182][183]

NKAbuse Malware

[edit]

In 2023, Kaspersky exposed NKAbuse, a sophisticated multiplatform malware written in the Go programming language. This malware leveraged blockchain technology for its peer-to-peer communication infrastructure, making it resilient to takedowns. NKAbuse functioned as a flooder and a backdoor, enabling attackers to launch distributed denial-of-service (DDoS) attacks and gain persistent access to compromised systems. The campaign illustrated the evolving use of blockchain in cybercrime and reinforced the need for enhanced detection methods.[184][185]

Triangulation

[edit]

In 2023, Kaspersky uncovered Triangulation, a sophisticated spyware campaign targeting iOS mobile devices. The malware exploited multiple zero-day vulnerabilities to gain full control of targeted devices. Triangulation was primarily distributed through malicious attachments in instant messaging apps. Once installed, it allowed attackers to access encrypted communications, GPS locations, and sensitive data. Kaspersky attributed the campaign to an advanced persistent threat (APT) group but refrained from naming a specific actor, though evidence suggested ties to state-sponsored espionage.[186][187]

CloudSorcerer/EastWind

[edit]

CloudSorcerer APT and its EastWind campaign were identified by Kaspersky in 2024.The malware leveraged public cloud infrastructure to perform large-scale data exfiltration and surveillance. The attackers used sophisticated phishing campaigns to infiltrate government and private sector organizations, especially targeting research institutions and critical infrastructure. CloudSorcerer employed novel encryption techniques to disguise data flows, complicating detection. Kaspersky linked the malware to a state-affiliated group but did not specify which country was behind the attack.[188][189]

DuneQuixote

[edit]

In 2024, Kaspersky exposed DuneQuixote, a stealthy malware campaign targeting intellectual property in the technology and energy sectors. The malware used custom-built exploits and employed fileless techniques, operating entirely in memory to evade detection by traditional security tools. DuneQuixote's attack vector included compromised software updates and supply chain vulnerabilities. Kaspersky attributed the operation to a well-funded APT group with global reach, though the precise origin remained unclear. The discovery highlighted the growing complexity of threats targeting high-value intellectual assets.[190]

SparkCat

[edit]

In February 2025 discovers SparkCat, a first OCR infostealer found in iOS App Store.[191] On iOS and Android, infostealer requests access to users' photo galleries when they attempt to use support chat in an infected app. Once granted permission, the malware uses Google's OCR technology to decipher text in photos and looks for screenshots of passwords or phrases to regain access to cryptocurrency, then sends them to the attacker.[192] By February 10, 2025, Apple and Google had removed about 20 apps from their app stores, but the malware remained available in unofficial stores and websites.[193]

Bans and allegations of Russian government ties

[edit]

Since 2015, Western media outlets and governments have accused Kaspersky of having close ties to the Russian government. In 2017, allegations emerged that hackers had used Kaspersky software to steal confidential data from the home computer of a contractor for the US National Security Agency (NSA). Kaspersky denied the allegations, reporting that the software had detected Equation Group malware samples which it uploaded to its servers for analysis in its normal course of operation.[194]

In September 2017, the US Department of Homeland Security banned federal agencies from using and purchasing Kaspersky software, requiring them to remove it from their systems within 90 days.[18] In December, President Donald Trump signed the National Defense Authorization Act for Fiscal Year 2018, which extended this ban to military computers.[195] In response, the company launched a “Global Transparency Initiative”, moving its infrastructure to process customer data to Switzerland and opening transparency centers in a number of countries to allow customers and regulators to review its source code and data processing practices.[196][197]

In 2022, following Russian invasion of Ukraine, the US warned companies about the risks of using Kaspersky software, and the FCC added it to its list of national security threats.[198] In response, the company said the decision was political and expressed its willingness to cooperate with the authorities to address their concerns.[199] In 2024, leaked emails showed that Kaspersky allegedly helped Russia develop software for spy drones.[200]

In April 2024, it became known that the US Department of Commerce was considering a complete ban on the sale of Kaspersky products.[201] On June 20, Secretary of Commerce Gina Raimondo announced that sales would be banned in the US from July 20 and software updates from September 29, as part of Trump and Biden's executive orders on protecting data from “foreign adversaries.”[202][201] In July, the company announced the closure of its US office and the dismissal of its staff,[203] and on July 17, it offered US customers six months of free updates, warning of limited functionality after September 29.[204]

In February 2025, Australia banned the use of Kaspersky software in government agencies due to national security concerns. The Department of Home Affairs ordered its removal from government devices by April 1, bringing the country into line with other members of the Five Eyes intelligence pact — the US, Canada, and the UK.[205][206]

See also

[edit]

Notes

[edit]

References

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
Kaspersky Lab is a privately held cybersecurity company founded on June 26, 1997, in , , by and a group of software developers specializing in . Headquartered at 39A Leningradskoe Shosse in , the firm develops endpoint protection solutions, , and threat intelligence services used by over 400 million individuals and organizations globally. Its products have consistently ranked highly in independent tests for detection accuracy, earning top awards from labs like and SE Labs, including nine AV-TEST Best Protection awards in 2024 and a 97% TOP3 placement rate across 95 evaluations. Despite these technical achievements, Kaspersky Lab has encountered significant geopolitical controversies, particularly from Western governments wary of its Russian base; in 2017, the U.S. Department of prohibited its software in federal agencies citing risks tied to potential Russian government influence, a stance formalized in 2024 with a Commerce Department ban on its U.S. operations and Treasury sanctions on leadership amid heightened U.S.- tensions. The company has maintained its independence, denying intelligence ties and proposing transparency measures like third-party code audits, though such assurances have not alleviated restrictions in countries including the U.S., , and .

Founding and History

Establishment and Early Development (1997–2005)

Eugene Kaspersky, who had studied mathematics and at the Institute of Cryptography, Telecommunications and —a Soviet institution linked to intelligence training—graduated in 1987 and shifted focus to amid the USSR's collapse. In 1989, he encountered the on his computer, prompting the creation of his initial virus removal tool and marking the start of systematic malware analysis grounded in techniques derived from . By 1991, Kaspersky joined the KAMI Information Technologies Center, a private Russian firm specializing in IT security during the chaotic post-Soviet economic transition, where lax infrastructure and proliferating bootleg software fueled outbreaks. There, he assembled a small team to develop Anti-Viral Toolkit Pro (AVP), released around 1992 as a DOS-based scanner emphasizing signature-based detection supplemented by early methods to identify unknown threats through behavioral anomalies—approaches informed by empirical disassembly rather than theoretical models alone. AVP gained initial traction in via distribution and for system disinfection, addressing the era's rudimentary like file infectors targeting financial and data systems. Kaspersky Lab emerged on June 26, 1997, as a spin-off from KAMI, founded by and associates including to commercialize and expand AVP into a dedicated antivirus enterprise, with the explicit aim of producing the world's leading protection amid Russia's nascent and rising cyber risks from disorganized digital adoption. The nascent company operated from with a lean team prioritizing resource-efficient tools, such as a lightweight Windows variant of AVP that outperformed bulkier DOS predecessors in speed and compatibility, distributed initially through pirated channels and direct sales to enterprises needing reliable scanning. Early advancements solidified its technical foundation: in 1998, AVP uniquely detected and neutralized the CIH (Chernobyl) virus, which overwrote firmware on millions of systems, showcasing the efficacy of Kaspersky's reverse-engineering pipeline over competitors reliant on incomplete signatures. Through the early , the lab refined proactive detection, integrating genetic algorithms for heuristic evolution and daily database updates—pioneering hourly signatures by 2004—to counter evolving polymorphic threats in an environment where empirical sample collection from infected machines drove causal insights into propagation. This period established Kaspersky's reputation for undiluted analysis, with AVP evolving into by 2000, focusing on core engine improvements without diluting efforts into non-essential features.

International Growth and Milestones (2006–2015)

Kaspersky Lab accelerated its international expansion in the mid-2000s by establishing offices in key Western and Asian markets, including Germany, France, Italy, Spain, Japan, and China. By 2010, the company operated in more than 100 countries through a network of partners exceeding 500, facilitating distribution of its antivirus solutions globally. This growth continued, with presence extending to approximately 200 countries and territories by the mid-2010s, supported by 29 representative offices worldwide as reported in 2013. The company's research division played a pivotal role in milestones that enhanced its reputation for advanced threat detection. In June 2010, Kaspersky researcher Sergey Ulasen identified the worm, a sophisticated cyber weapon targeting programmable logic controllers in Iran's nuclear facility, marking one of the first documented instances of state-sponsored industrial sabotage via malware. This discovery involved reverse-engineering complex code exploiting zero-day vulnerabilities, demonstrating Kaspersky's capability in dissecting nation-state level threats. Subsequent breakthroughs included the 2012 analysis of , a modular toolkit with worm-like propagation, which Kaspersky Lab detailed as far more complex than predecessors like , featuring capabilities for , screenshot capture, and audio recording primarily affecting systems in the . In February 2015, Kaspersky uncovered the Equation Group, an actor linked to firmware-level infections and considered the developer of tools ancestral to and , with operations dating back to 2001 and employing unprecedented cyber- techniques. Kaspersky's investments in yielded strong performance validations, participating in 93 independent tests in 2014 and securing first place in 51, with top-three rankings in 71% overall. Products like earned the AV-TEST Best Performance Award for 2014, reflecting low system impact alongside high detection rates. These achievements underscored the company's growing stature amid expanding global operations.

Modern Era and Challenges (2016–Present)

In June 2024, the U.S. Department of Commerce issued a final determination prohibiting Kaspersky Lab from providing software sales, updates, and support to U.S. persons, effective for new transactions after July 20, 2024, and ceasing updates on September 29, 2024, due to assessed national security risks stemming from the company's Russian origins and potential influence by the Russian government. Kaspersky contested the ruling as driven by geopolitical tensions rather than empirical evidence of misconduct, emphasizing prior transparency initiatives like code audits and data processing relocations outside Russia, which U.S. authorities had declined. The company complied by halting U.S.-directed operations, though reports indicated some users circumvented update restrictions via VPNs to maintain functionality post-ban. Despite these pressures, Kaspersky sustained its threat research output, disclosing Operation Triangulation in June 2023 as an advanced spyware campaign exploiting four zero-day vulnerabilities to implant persistent surveillance tools on targeted devices, including those of Kaspersky employees. In July 2024, the firm identified CloudSorcerer, a novel APT employing cloud services like for command-and-control to infiltrate Russian government networks. This evolved into the EastWind campaign by August 2024, where attackers deployed updated CloudSorcerer variants alongside tools from Chinese-linked groups like APT31 to compromise dozens of Russian state and IT systems via spear-phishing. Kaspersky's monitoring in 2025 revealed further adaptations by threat actors, including a campaign detected in the second half of 2024—extending into 2025—where retrieved payloads and commands from legitimate platforms such as , , Learn, and social networks to deliver Cobalt Strike beacons against organizations in , , , , and . Annual threat intelligence from Kaspersky highlighted escalating volumes, with Windows detections rising 19% from 2023 to 2024, averaging 467,000 unique malicious files daily. Android users faced a 29% surge in attacks during the first half of 2025 versus the same period in 2024, driven by banking trojans and . persisted as a core trend, with targeted groups proliferating despite disruptions, as detections fell 18% overall in 2024 but victim announcements by active families like LockBit continued unabated. Kaspersky Premium validated its efficacy in independent testing, blocking 93% of URLs in AV-Comparatives' 2024 evaluation without false positives.

Products and Services

Consumer Security Solutions

Kaspersky provides a range of consumer products tailored for individual users and households, including , , Total Security, and Premium. These solutions emphasize real-time threat detection, system optimization, and privacy tools without enterprise-scale management features. Core functionalities encompass antivirus scanning, firewall protection, and anti-phishing measures across Windows, macOS, Android, and devices. Kaspersky Premium integrates comprehensive antivirus with unlimited VPN access, a , identity protection, and data leak monitoring, offering multi-device coverage for up to 10 endpoints. Kaspersky Total Security adds , secure payment protection, and file , focusing on family-oriented safeguards against and trojans through and signature-based analysis. Both products employ behavioral monitoring to identify zero-day threats, supplemented by cloud-assisted updates for rapid response to emerging variants. Independent evaluations highlight Kaspersky's efficacy in consumer scenarios, with 2024 AV-Comparatives tests awarding Advanced+ ratings for protection, including high detection rates against trojans (over 99%) and samples. The solutions recorded zero false positives in multiple assessments from 2024 to early 2025, minimizing disruptions to legitimate applications while blocking advanced persistent threats. AV-Comparatives granted a Gold Award for low false alarms in 2024, confirming robust performance in real-world file and web-based attack simulations. Integration of enhances proactive defense, with Kaspersky's systems analyzing file behaviors to preempt exploits like DLL hijacking. In , Kaspersky's global detection infrastructure identified an average of 467,000 unique malicious files daily, reflecting the scale of threats countered by consumer-grade engines updated in real-time. These capabilities ensure high efficacy against prevalent consumer risks, such as and drive-by downloads, without compromising device performance, as evidenced by low impact scores in independent benchmarks.

Enterprise and Industrial Cybersecurity Offerings

Kaspersky's enterprise cybersecurity offerings include (EDR) solutions designed to protect corporate endpoints from advanced threats through continuous event aggregation, machine learning-based detection, and automated response actions such as network isolation and file quarantine. These tools enable security teams to investigate incidents using behavioral analysis and threat hunting capabilities, supporting scalability across laptops, servers, and cloud workloads without requiring additional agents in some configurations. For virtualized environments, Kaspersky Security for Virtualization provides light-agent and agentless protection for virtual machines running Windows operating systems, including servers, with multi-layered defenses against , network attacks, and vulnerability exploitation. This solution integrates with platforms like to minimize performance overhead while enforcing file-level scanning, anti-ransomware measures, and centralized management for virtual desktop infrastructure (VDI) and server . In the industrial sector, Kaspersky Industrial Cybersecurity serves as an XDR platform tailored for (OT) systems, including () and industrial control systems (ICS), by monitoring network traffic, detecting anomalies in , and facilitating rapid threat response to safeguard assets from targeted attacks. It addresses risks through visibility into OT protocols and integration with endpoint protection, helping organizations maintain compliance with industrial security standards by isolating vulnerable segments and providing forensic data for incident analysis. A notable application involved collaboration with Vietnamese authorities in a 2020 national detection and removal campaign, where Kaspersky supplied removal tools and shared threat , contributing to substantial reductions in detected cyber threats across the country by 2022, including offline threats dropping by up to 54.74% in some metrics. This initiative demonstrated the efficacy of integrated enterprise tools and sharing in mitigating widespread propagation in resource-constrained environments.

Threat Intelligence Platforms

Kaspersky's threat intelligence platforms leverage the Kaspersky Security Network (KSN), a cloud-based that aggregates and analyzes from over a billion devices worldwide to generate actionable insights on emerging cyberthreats. KSN processes vast datasets including samples, indicators, and attack patterns, enabling real-time threat detection and informing global cybersecurity strategies. This network underpins Kaspersky's (CTI) services, which include APIs for integration with third-party tools like Resilient and , facilitating proactive defense through automated threat feeds and enrichment. Key platforms for threat dissemination include the Threat Intelligence Portal (TIP), which provides tailored real-time overviews of threats by geography, industry, platforms, actor profiles, software, and techniques, updated as of October 16, 2024. Securelist serves as the primary blog for publishing research reports, such as the Kaspersky Security Bulletin 2024 statistics covering November 2023 to October 2024, and the State of Ransomware Report 2025 released on May 7, 2025, which analyzes global trends using KSN data. The Global Research and Analysis Team (GReAT) contributes specialized analysis integrated into these platforms, focusing on advanced threat trends without delving into specific campaigns. Kaspersky also offers open-source oriented tools, such as the Threats Data Feed, a binary-less exposing vulnerabilities and threats in millions of open-source packages derived from KSN intelligence. In recognition of these capabilities, named Kaspersky a Leader in the 2024 Frost Radar for on May 14, 2025, citing its comprehensive portfolio of 10 CTI modules, global research scale, and innovation in scalable threat intelligence delivery. This positioning highlights Kaspersky's emphasis on empirical over narrative-driven assessments, though independent verification of KSN's breadth remains limited to Kaspersky's disclosures.

Security Research and Discoveries

Pioneering Malware Analysis Techniques

Kaspersky Lab's malware analysis methodologies trace their origins to founder Eugene Kaspersky's early efforts in during the late 1980s and 1990s. In 1989, Kaspersky encountered the Cascade virus on his work computer and developed the first tool to remove it by dissecting its code structure and behavior, establishing a foundation in of malicious software rather than mere . This approach expanded with the 1991 AVP antivirus project, where systematic code examination enabled the identification and neutralization of emerging threats through proactive disassembly. Central to these techniques is , introduced by Kaspersky in the 1990s to detect unknown by scrutinizing executable code for anomalous properties indicative of malicious intent, such as or injection routines, thereby addressing zero-day vulnerabilities beyond signature-based limitations. Building on this, the company advanced behavioral analytics and sandboxing, executing suspicious objects in isolated virtual environments to monitor runtime actions and extract indicators of compromise (IOCs) like network calls or file modifications. These methods, refined through global from millions of endpoints, prioritize understanding malware causality, contributing to detection rates exceeding 99% in controlled tests against advanced persistent threats. The efficacy of Kaspersky's emphasis on and behavioral monitoring is evidenced by its performance in independent evaluations; in 2014, Kaspersky products secured first place in 51 of 93 tests conducted by organizations like , outperforming competitors reliant on static detection. Complementing internal advancements, Kaspersky fosters transparency by publicly releasing IOCs, rules, and analytical tools via Securelist, allowing peer verification and collective industry response to novel threats without proprietary withholding. This open dissemination of dissective insights has accelerated shared defenses, distinguishing Kaspersky's contributions from detection-centric paradigms.

Key Advanced Persistent Threat (APT) and Malware Campaigns Uncovered

Kaspersky Lab's Global Research and Analysis Team (GReAT) uncovered the Red October cyber-espionage platform in October 2012, with public disclosure in January 2013; active since 2007, it targeted over 100 diplomatic, governmental, and scientific organizations across 39 countries, primarily in , the , and , using modular components for data theft from networks including air-gapped systems via USB drives and peripherals. The malware's sophistication, including custom and stealthy persistence, highlighted state-level capabilities, though attributions remained data-driven based on indicators like victim profiles and code artifacts rather than geopolitical assumptions. In May 2012, Kaspersky researchers linked the Flame malware—discovered targeting Middle Eastern systems—to Stuxnet and Duqu through shared code modules and development toolchain, revealing a cluster of wiper and espionage tools deployed from 2010 onward that sabotaged Iranian nuclear centrifuges and spied on air-gapped networks; Flame alone spanned 20 MB with multiple propagation vectors, including Bluetooth and Windows updates, affecting systems in Iran, Israel, and beyond. These findings, corroborated by binary analysis, underscored interconnected nation-state operations without presuming actor identities beyond empirical overlaps in exploits. February 2014 saw the exposure of The Mask (also known as ), an APT campaign active since 2008 targeting governments, private firms, and individuals in over 30 countries, employing multi-platform (Windows, Mac, Android, ) with advanced evasion like in-memory execution and a custom peer-to-peer protocol for command-and-control; Kaspersky deemed it the most complex toolset encountered, with victims including European institutions and North African entities, based on reverse-engineered implants and traffic patterns. Attribution leaned toward sophisticated actors via linguistic artifacts in code, emphasizing technical realism over narrative fit. November 2014 analysis detailed , a modular espionage platform operational since 2008, infecting telecoms, governments, and research in , , , , , , , , and ; it enabled interception, network reconnaissance, and , with five stages and self-destruction mechanisms, linked to prior campaigns through but attributed neutrally via tooling overlaps rather than confirmed sponsors. Kaspersky's dissection revealed its use against 100+ targets, preventing broader compromise through shared indicators. The , disclosed in February 2015, represented Kaspersky's deepest probe into a active since 1996, infecting 500+ hard drives across 42 countries via firmware-level rootkits like "Fanny," predating and influencing / through shared libraries; tools enabled mass surveillance with 60+ implants, targeting , governments, and telecoms, with attributions derived from unique drivers and victim telemetry pointing to advanced persistent access without political bias. This discovery neutralized ongoing infections by exposing reusable modules. In February 2016, emerged as a commercial APT boutique selling zero-day exploits and implants for , targeting , , , , and media since 2013 in and the ; unlike state actors, it prioritized profit via off-the-shelf tools, uncovered through sinkholed C2 domains and code sales traces, demonstrating Kaspersky's detection of non-state threats via behavioral signatures. June 2023 revealed Operation Triangulation, a zero-click exploit chain using four undisclosed zero-days to install TriangleDB on iPhones of high-value targets (e.g., diplomats, via Kazakhstan-targeted ); it bypassed BlastDoor and exploited kernel vulnerabilities without interaction, active since at least 2019, with no user action required—attributed through exploit novelty and targeting, enabling full device compromise including location and messages. Kaspersky's prompted Apple patches, averting wider espionage. December 2023 exposed NKAbuse, a multi-platform (Linux, IoT) backdoor leveraging NKN blockchain for decentralized C2, enabling DDoS, cryptomining, and remote shells; deployed via compromised devices, it evaded detection through peer-to-peer networking, uncovered in incident response without state attribution but highlighting supply-chain risks. April 2024 detailed DuneQuixote, an espionage campaign deploying CR4T backdoor against Middle Eastern governments since early 2024, using DLL side-loading, obfuscated PowerShell, and living-off-the-land for persistence and exfiltration; over 30 artifacts linked it to prior ops via TTPs, focusing on credential theft without ideological framing. November 2024 reported a year-long PyPI supply-chain attack luring developers with AI chatbot packages modified to deliver JarkaStealer for credential and session theft; over 100 malicious uploads exploited Python's , detected via behavioral anomalies, preventing developer compromises. February 2025 uncovered SparkCat, an OCR-enabled stealer in and apps since March 2024, targeting crypto wallets by screenshotting recovery phrases; affecting /Android via legitimate-looking apps, it exfiltrated via Telegram, neutralized through app disassembly revealing OCR libraries. November 2019 identified Titanium, a backdoor by the Platinum APT group active against Asian targets, featuring anti-analysis and modular payloads for espionage; code evolution from prior tools confirmed actor continuity via hashing matches. These disclosures, rooted in reverse engineering and global telemetry, enabled mitigations averting damages estimated in billions, with no verified instances of Kaspersky facilitating threats—attributions prioritized causal evidence like code reuse and infrastructure over unverified claims.

Business Operations and Partnerships

Global Partnerships and Collaborations

Kaspersky Lab has established extensive collaborations with international law enforcement agencies, particularly , to facilitate threat intelligence sharing and coordinated operations against . In 2014, Kaspersky signed a three-year agreement with to enhance global combat efforts through joint and exchange. This partnership expanded in 2020 with a five-year extension focused on accelerating responses to cyber threats via shared intelligence. Recent contributions include Kaspersky's support for 's Operation Secure in June 2025, which disrupted infostealer infrastructure, and Operation Serengeti 2.0 in August 2025, leading to over 1,200 arrests through intelligence on distribution networks. Similarly, in Operation Synergia II (November 2024), Kaspersky provided on and , contributing to over 40 arrests. A prominent example of public-private collaboration is Kaspersky's founding role in the No More Ransom initiative, launched in July 2016 with Europol's European Cybercrime Centre, the ' National High Tech Crime Unit, and other security firms. The project provides free decryption tools and awareness resources, aiding over 1.5 million victims in file recovery by July 2022 without paying ransoms. Kaspersky's contributions include developing decryptors and integrating threat intelligence to expand the repository of tools for variants like 777 Ransom. In academic spheres, Kaspersky has pursued partnerships to advance and cybersecurity education. The Academy Alliance program, introduced in September 2023, collaborates with universities to integrate Kaspersky's cybersecurity curricula and tools into academic programs, fostering joint on emerging threats. This includes free online courses like "Cybersecurity: Entry Level" launched in September 2025 for first- and second-year students, emphasizing practical . Additionally, a 2020 program targeted universities and labs for industrial cybersecurity , enabling shared disclosures. Following U.S. restrictions, Kaspersky maintained non-U.S. partnerships, such as intelligence sharing with Vietnam's government since at least 2020 to identify botnets and support national detection campaigns. In December 2024, Kaspersky joined UNIDO's Global Alliance on AI for Industry and to share AI-driven threat detection practices in industrial sectors. These alliances underscore Kaspersky's emphasis on cross-border intelligence integration for proactive mitigation.

Financial Performance and Market Expansion

Kaspersky Lab's revenue grew steadily through the , supported by international expansion and a user base exceeding 400 million by 2016, enabling the company to achieve annual in the hundreds of millions of USD. By 2023, global non-audited combined reached USD 721 million, with net bookings increasing 11% year-over-year amid diversification into enterprise segments. This growth continued into 2024, when hit a record USD 822 million, reflecting an 11% increase driven by demand for products despite regulatory restrictions.
YearGlobal Revenue (USD million)
2023721
2024822
The company pursued diversification into and (OT) security to bolster resilience, launching specialized solutions like the Kaspersky Industrial Cybersecurity Platform for protecting legacy OT assets and industrial networks, alongside updates to Workload Security for threat detection in hybrid environments. These efforts targeted growing markets in and adoption, contributing to sustained revenue streams outside traditional endpoint protection. The June 2024 U.S. ban on sales and updates, enacted due to concerns, prompted Kaspersky to wind down U.S. operations, eliminate local positions, and forfeit that market segment, which represented a portion of prior North American revenues. However, the ban did not derail overall financial momentum, as evidenced by the 2024 revenue uptick and absence of reported liquidity issues or proceedings; instead, Kaspersky offset losses through accelerated expansion in and . Key moves included opening a Malaysian in 2023, establishing transparency centers in and in 2022, and constructing a in in 2024 to serve regional enterprise clients. Heavy investment in underpins this strategy, with more than one-third of Kaspersky's over 4,000 employees dedicated to R&D, focusing on in-house innovation for emerging threats in and OT domains. This allocation, representing a core operational expense, has enabled product evolution without reliance on external dependencies, supporting long-term amid market exclusions.

Independent Assessments and Reception

Third-Party Testing and Awards

Kaspersky security products have demonstrated high efficacy in independent laboratory evaluations conducted by AV-Comparatives and , with consistent top-tier results in malware detection, real-time , and low false positive rates. In AV-Comparatives' 2024 Summary Report, Kaspersky achieved a Top-Rated Product Award after earning Advanced+ ratings in six of seven main tests—including Real-World , Protection, and —indicating protection rates exceeding 99% against live threats and minimal system impact, alongside low false alarms. In phishing-specific assessments, Kaspersky Premium secured AV-Comparatives' "Approved" certification for 2025 by detecting 93% of URLs in real-time tests with zero false positives, outperforming the 85% threshold for certification and matching or exceeding peers in accuracy. AV-TEST evaluations further validate these capabilities, awarding Kaspersky nine "Best" distinctions in 2024 for categories such as Best Protection and Usability on Windows, Best macOS Security, and Best Advanced Protection, based on perfect or near-perfect scores (6/6 points) in protection against 0-day and widespread malware, real-time file and web scanning, and usability with negligible false positives. In the August 2025 Windows 11 test, Kaspersky Premium earned Top Product status, signifying full compliance across protection, performance, and false alarm metrics. These lab results highlight Kaspersky's behavioral and detection strengths in blocking and other advanced threats, as evidenced by zero false alarms on in AV-Comparatives' 2025 Business Security Test and historical 100% prevention in targeted scenarios, though direct 2025 peer comparisons in -specific blocking remain integrated within broader protection evaluations.

Market Position and User Feedback

Kaspersky Lab achieved record global revenues of $822 million in 2024, reflecting an 11% year-over-year increase and demonstrating resilience in competitive markets despite geopolitical challenges. This financial growth positions the company as a notable player in , particularly through its detection of advanced threats, with systems identifying an average of 467,000 malicious files daily—a 14% rise from previous years. The U.S. ban, enforced from September 29, 2024, compelled American enterprises and consumers to migrate to alternatives like and Pango's UltraAV, yet reports indicate no documented widespread breaches linked to Kaspersky's software during the transition period. Such shifts have introduced user skepticism regarding long-term viability in restricted regions, though the company's threat intelligence continues to underpin its market relevance elsewhere. User experiences emphasize Kaspersky's strong malware-blocking performance, with reviews noting near-perfect detection rates and low system resource usage in real-world tests. Community discussions, including technical forums, frequently commend its efficacy against evolving threats, positioning it as a top-tier option for protection prior to ban-related disruptions. Post-ban feedback highlights apprehensions over halted updates, prompting evaluations of competitors, but affirms retained trust in its core detection capabilities where operational.

Controversies, Allegations, and Regulatory Actions

Claims of Russian Government Influence

Allegations of Russian government influence over Kaspersky Lab have centered on the professional background of its founder and CEO, , who graduated in 1987 from the Institute of Cryptography, Telecommunications, and —a technical school operated under the auspices of the during the Soviet era. Kaspersky subsequently worked from 1989 to 1991 at a research institute under the Soviet Ministry of Medium Machine Building, which focused on cryptography for defense applications, though he has stated his role involved no intelligence activities and predated the company's founding in 1997. A pivotal claim arose in October 2017 from Israeli intelligence findings, which revealed that Russian government-affiliated hackers had leveraged software installed on millions of computers to scan for and exfiltrate U.S. (NSA) data. According to reports citing U.S. and Israeli officials, the operation involved searching for keywords such as "classified" and specific NSA tools on a former NSA contractor's , where the software's file-scanning feature identified sensitive materials inadvertently scanned during a routine check of pirated files. Proponents of the allegations argued this demonstrated Kaspersky's software enabling Russian access, potentially due to undisclosed ties, though Kaspersky maintained it had no knowledge of or complicity in the incident and emphasized the autonomy of its detection processes. Critics have also highlighted Kaspersky's 2015 public disclosure of the Equation Group, an advanced cyber espionage actor using highly sophisticated malware later widely attributed to the NSA's Tailored Access Operations unit, as potentially motivated by Russian strategic interests in exposing U.S. capabilities while concealing domestic threats. These claims gained traction amid broader U.S.-Russia geopolitical frictions, including investigations into Russian election interference in 2016, but no independently verified evidence of built-in backdoors, intentional data exfiltration to Russian authorities, or direct FSB control over Kaspersky's operations has been publicly disclosed. Counterarguments to influence assertions include Kaspersky's track record of uncovering state-sponsored threats irrespective of national origin, such as its analysis of Russian-linked actors in campaigns like those attributed to the group, which suggest operational independence rather than selective bias. Despite persistent suspicions fueled by Russia's mandatory laws and Kaspersky's headquarters, independent reviews and the absence of forensic proof for compromised integrity have led some experts to view the allegations as inferential rather than empirically substantiated.

International Bans and Restrictions

In December 2017, prohibited the use of Kaspersky Lab software on sensitive computers managing , including , , , and systems, deeming it a threat due to the company's Russian origins and potential for data access by foreign entities. The initiated restrictions in September 2017 when the Department of directed federal agencies to remove Kaspersky products from government networks within 90 days, citing concerns over ties to the Russian government that could enable unauthorized or insertion. This was followed by escalations culminating in a June 20, 2024, determination by the Commerce Department's , which added Kaspersky Lab, Inc., and its affiliates to the Entity List under and services rules, prohibiting new sales, agreements, or updates to U.S. persons effective July 20, 2024, for sales and September 29, 2024, for updates, based on assessments of undue risk from Russia's demonstrated intent to exploit such software for sensitive data access and potential . Australia imposed a ban on Kaspersky products and web services for all non-corporate government entities in February 2025, mandating complete removal by April 1, 2025, over risks linked to Russian state influence, aligning with prior advisories against its use in sensitive environments. The has maintained partial restrictions, with the National Cyber Security Centre advising against Kaspersky deployment in government systems since 2018 due to similar geopolitical risks, though without a comprehensive nationwide . No European Union-wide ban has been enacted despite internal reviews; in 2019, the stated it possessed no evidence that Kaspersky software was malicious or used for spying, even as individual member states like restricted its use in federal offices in 2022 based on risk evaluations. These measures have compelled affected users, particularly in government sectors, to transition to alternative security solutions, incurring operational costs and disruptions, yet no publicly verified instances exist of Kaspersky software being exploited to compromise systems or exfiltrate data on behalf of foreign actors. Bans were justified primarily on prospective risks from the software's deep system access and Kaspersky's operational obligations under Russian law, rather than documented breaches, raising questions about proportionality in light of the absence of empirical exploitation evidence against the company's products.

Company Responses, Transparency Efforts, and Evidence Reviews

In response to allegations of ties to the Russian government, Kaspersky Lab has consistently denied any inappropriate connections or cooperation beyond legal compliance requirements, stating that it has never assisted foreign intelligence and receives no requests from Russian authorities that violate its policies. The company emphasized in that critics' claims misinterpreted its lawful interactions with Russian regulators, such as obtaining necessary certifications, without evidence of data sharing for purposes. To address security concerns, Kaspersky launched its Global Transparency Initiative (GTI) in 2018, which included relocating all cyberthreat intelligence data processing and storage to Zurich, Switzerland, by the end of that year to ensure independence from Russian jurisdiction. As part of GTI, the company established multiple Transparency Centers worldwide, starting with facilities in Moscow and Zurich, allowing verified partners, governments, and researchers to independently review source code, software updates, threat detection rules, and vulnerability assessments under non-disclosure agreements. By 2024, additional centers opened in Istanbul (April), Seoul (September), and Bogotá (November), enabling on-site code audits with Kaspersky expert assistance, such as the "Black Piste" program for comprehensive source code examinations. Kaspersky offered third-party source code reviews as early as October 2017, inviting independent experts to audit its antivirus engine by the first quarter of 2018, followed by evaluations of update mechanisms and detection heuristics. These efforts extended to formal certifications, including standards for secure software development in , and ongoing independent assessments like the SOC 2 Type II audit renewed in November 2024, which verified controls over and development processes without identifying backdoors or unauthorized access mechanisms. In response to the 2017 U.S. federal ban, Kaspersky voluntarily ceased sales and updates in the U.S. market and proposed further mitigations, such as server relocation outside , though these were not accepted by U.S. authorities. Evidence from these audits has consistently shown no embedded backdoors or deliberate vulnerabilities in Kaspersky's products, with reviews attributing any perceived risks to circumstantial factors like the company's Russian origins rather than direct causal links to state-sponsored operations. Kaspersky has argued that independent verifications demonstrate its software's integrity, countering claims reliant on unproven assumptions of compelled cooperation under Russian law, as no specific instances of misused have been publicly substantiated by critics.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.